How to weaponize LLMs to auto-hijack websites

Researchers at UIUC showed that LLM-based agents—using tools like the OpenAI Assistants API, LangChain, and Playwright—can autonomously probe and exploit web application vulnerabilities (including SQL injection, XSS, and CSRF) in sandboxed tests; GPT-4 achieved substantially higher success rates than GPT-3.5 and open-source models, and the paper also discusses cost comparisons and safety/policy implications.